Responsible disclosure: pulling 175,000+ event photos without logging in
A race-photography platform's 'find your face' product gated photos behind facial search in the UI, but the API behind it had no auth at all. Here's how a handful of curl requests turned into a full export of two events' photo libraries, and why access-control flags in a JSON response mean nothing if the server never checks them.